1

I'm using a dll proxy with the code described here, but having tons of trouble.

First, I use VS2012 on Windows 7 and the target is on Windows XP. So I needed to:

  1. Install VCRedist on the target computer (I'd like to get around that if possible, suggestions will be greately appriciated)
  2. Update my VS to at least Update 1 (I've updated to Update 4) to have XP compilation support.

I did both of these, and the errors have changed. But still I get this error when the program starts:

The application failed to initialize properly (0xc000007b)

And it doesn't run.

The DLL proxy I'm using is basically the default example from the code project article. I've added a message box and a log file write on the DllMain and it doesn't show, meaning the dll isn't even loaded - But I don't get why.

How can I debug this? Is this a compilation configuration issue?

EDIT: I've written a testing program that calls LoadLibrary with my dll proxy, and it works okay. So I'm thinking it's not a CRT dlls thing. Anyway, here's the info from WinDbg after I compiled with /MT (I'm sorry but I had to remove companies and application names):

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: "C:\Program Files\AppName\AppName.exe"
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is: 
ModLoad: 12400000 12bdb000   AppName.exe
ModLoad: 7c900000 7c9b2000   ntdll.dll
ModLoad: 7c800000 7c8f6000   C:\WINDOWS\system32\kernel32.dll
ModLoad: 60000000 6006d000   C:\WINDOWS\cdmapi32.dll
ModLoad: 73dd0000 73ece000   C:\WINDOWS\system32\MFC42.DLL
ModLoad: 77c10000 77c68000   C:\WINDOWS\system32\msvcrt.dll
ModLoad: 77f10000 77f59000   C:\WINDOWS\system32\GDI32.dll
ModLoad: 7e410000 7e4a1000   C:\WINDOWS\system32\USER32.dll
ModLoad: 77dd0000 77e6b000   C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 77e70000 77f02000   C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 77fe0000 77ff1000   C:\WINDOWS\system32\Secur32.dll
ModLoad: 5d090000 5d12a000   C:\WINDOWS\system32\COMCTL32.dll
ModLoad: 774e0000 7761e000   C:\WINDOWS\system32\ole32.dll
ModLoad: 77120000 771ab000   C:\WINDOWS\system32\OLEAUT32.dll
ModLoad: 76080000 760e5000   C:\WINDOWS\system32\MSVCP60.dll
ModLoad: 77c00000 77c08000   C:\WINDOWS\system32\VERSION.dll
ModLoad: 76b40000 76b6d000   C:\WINDOWS\system32\WINMM.dll
ModLoad: 76390000 763ad000   C:\WINDOWS\system32\IMM32.dll
ModLoad: 76380000 76385000   C:\WINDOWS\system32\MSIMG32.dll
ModLoad: 763b0000 763f9000   C:\WINDOWS\system32\comdlg32.dll
ModLoad: 7c9c0000 7d1d7000   C:\WINDOWS\system32\SHELL32.dll
ModLoad: 77f60000 77fd6000   C:\WINDOWS\system32\SHLWAPI.dll
ModLoad: 73000000 73026000   C:\WINDOWS\system32\WINSPOOL.DRV
ModLoad: 00340000 00356000   C:\Program Files\AppName\DllName.dll
(dc8.68c): Unknown exception - code c000007b (first chance)
(dc8.68c): Unknown exception - code c000007b (!!! second chance !!!)
eax=0012fc54 ebx=00000000 ecx=0012fc80 edx=7c90e514 esi=7ffdc000 edi=c000007b
eip=7c9673be esp=0012fc54 ebp=0012fca4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - 
ntdll!RtlRaiseStatus+0x26:
7c9673be c9              leave

I've checked procmon, here's the last few lines:

9:56:07.8699734 PM  AppName.exe 496 QueryOpen   C:\Program Files\AppName\DllName.dll    SUCCESS CreationTime: 8/31/2014 2:14:39 PM, LastAccessTime: 8/31/2014 9:55:22 PM, LastWriteTime: 8/31/2014 7:14:29 PM, ChangeTime: 8/31/2014 7:14:29 PM, AllocationSize: 73,728, EndOfFile: 70,656, FileAttributes: A
9:56:07.8704646 PM  AppName.exe 496 QueryOpen   C:\Program Files\AppName\DllName.dll    SUCCESS CreationTime: 8/31/2014 2:14:39 PM, LastAccessTime: 8/31/2014 9:55:22 PM, LastWriteTime: 8/31/2014 7:14:29 PM, ChangeTime: 8/31/2014 7:14:29 PM, AllocationSize: 73,728, EndOfFile: 70,656, FileAttributes: A
9:56:07.8709551 PM  AppName.exe 496 CreateFile  C:\Program Files\AppName\DllName.dll    SUCCESS Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened
9:56:07.8713057 PM  AppName.exe 496 CreateFileMapping   C:\Program Files\AppName\DllName.dll    SUCCESS SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE
9:56:07.8714685 PM  AppName.exe 496 CreateFileMapping   C:\Program Files\AppName\DllName.dll    SUCCESS SyncType: SyncTypeOther
9:56:07.8718270 PM  AppName.exe 496 CloseFile   C:\Program Files\AppName\DllName.dll    SUCCESS 
9:56:07.8724308 PM  AppName.exe 496 Load Image  C:\Program Files\AppName\DllName.dll    SUCCESS Image Base: 0x340000, Image Size: 0x16000
9:56:07.8737372 PM  AppName.exe 496 CreateFile  C:\Program Files\AppName\DllName.dll.2.Manifest NAME NOT FOUND  Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a
9:56:07.8746961 PM  AppName.exe 496 CreateFile  C:\Program Files\AppName\DllName.dll.2.Config   NAME NOT FOUND  Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a
9:56:09.0143355 PM  AppName.exe 496 Thread Exit     SUCCESS Thread ID: 4064, User Time: 0.0000000, Kernel Time: 0.0468750
9:56:09.0151822 PM  AppName.exe 496 Process Exit        SUCCESS Exit Status: -1073741701, User Time: 0.0156250 seconds, Kernel Time: 0.0468750 seconds, Private Bytes: 2,572,288, Peak Private Bytes: 2,588,672, Working Set: 1,761,280, Peak Working Set: 1,765,376
9:56:09.0158711 PM  AppName.exe 496 CloseFile   C:\Program Files\AppName    SUCCESS 

It seems that it fails searching for the manifest and config files. Is this a problem?

  • I don't really get how your question is related to reverse-engineering... You may have a better answer on ServerFault. – perror Aug 31 '14 at 12:48
  • It's a dll proxy - as commonly used in reversing – Nitay Aug 31 '14 at 13:36
  • considering ntstatus, something's wrong with (your) image. Maybe x86/x64 issue? Who can guess without further info. Open procmon and check when the loading breaks, or start debugger if you really want to debug. – qwm Aug 31 '14 at 14:45
  • I've checked procmon and added the info to the question – Nitay Aug 31 '14 at 20:17
2

The problem happens due to the fact that the required CRT DLL's are missing on the target machine. To avoid this you can link against the CRT statically. Use the Multi-threaded (/MT) linker flags in VS. This way you also do not need to install VCRedist on target computer.

More info here

Another way is to install Dependency Walker on the target machine, open the required PE file and note which dependencies are missing and then copy the required dependencies there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.